All vulnerabilities

Servers and applications

CVE-2021-29922

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Severity
Critical 9.1
Published
7 Aug 2021
Last changed
17 Jun 2026
Added to UpHeron
22 Oct 2026
Fixed in
1.53.0
Sources
NVD

Affected software

SoftwareAffected versions
RustServers and applications · cpe:a:rust-lang:rust
  • Every version before 1.53.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-29922
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-29922